dpdk: Incomplete Filtering of Special Elements
CVE-2022-2132 is a high-severity incomplete filtering of special elements vulnerability in dpdk, with a CVSS 3.1 base score of 8.6 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected dpdk versions: dpdk 21.11, dpdk 20.11, dpdk 19.11. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 2.39% chance of exploitation within 30 days, higher than 84% of scored CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Data Plane Development Kit to 19.11 or 20.11 or 21.11, whichever matches your release line, or a later version.
- Read the advisory on bugs.dpdk.org for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Dpdk | dpdk | dpdk 21.11, dpdk 20.11, dpdk 19.11 | Not stated |
| Dpdk | Data Plane Development Kit | before 19.11; 20.0 up to, but not including, 20.11; 21.0 up to, but not including, 21.11 | 19.11, 20.11, 21.11 |
| Fedora Project | Fedora | 36 | Not stated |
| Debian | Debian Linux | 10.0 | Not stated |
| Red Hat | Enterprise Linux Fast Datapath | 7.0; 8.0; 9.0 | Not stated |
| Red Hat | Openshift Container Platform | 4.0 | Not stated |
| Red Hat | Openstack Platform | 13.0 | Not stated |
| Red Hat | Virtualization | 4.0 | Not stated |
| Red Hat | Enterprise Linux | 7.0; 8.0; 9.0 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. Scored by NVD.
Official description
A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Incomplete Filtering of Special Elements
The product receives data from an upstream component, but it does not completely filter special elements before sending it to a downstream component.
More Incomplete Filtering of Special Elements vulnerabilities (CWE-791)
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Advisories
- bugs.dpdk.org/show_bug.cgi?id=1031Exploit, Issue Tracking
Third-party and government advisories
- lists.debian.org/debian-lts-announce/2022/09/msg00000.htmlMailing List, Third Party Advisory
Technical write-ups (may include proof of concept)
- bugzilla.redhat.com/show_bug.cgi?id=2099475Exploit, Issue Tracking, Third Party Advisory
Spotted an error? Tell us.